What is GHSA-4prj-22r4-mcwx?

GHSA-4prj-22r4-mcwx is a security advisory published by GitHub Security Advisories with Medium severity. The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against...

Which CVE IDs does GHSA-4prj-22r4-mcwx cover?

GHSA-4prj-22r4-mcwx covers the following CVE IDs: CVE-2026-107120. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4prj-22r4-mcwx?

GHSA-4prj-22r4-mcwx has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-4prj-22r4-mcwxMediumCVSS 5.3

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against...

Vendor

GitHub Security Advisories

Published

October 10, 2026

Last Modified

October 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-107120 →

📋 Description

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-107120
https://wpscan.com/vulnerability/13853303-741e-4f87-8543-d5d825d20e8e
https://github.com/advisories/GHSA-4prj-22r4-mcwx